Hi,
First, I would recommend the following changes on your RADIUS and AAA configs (statically define the source interface for RADIUS generated packets to avoid this changing due to potential routing changes; per your current scope you don't need authorization for config-commands enabled, you might need in future, so you can leave this command on or remove it, doesn't matter at this point; I'm assuming you want the same behaviour to apply for console access as it does for VTY / SSH access, for which reason you need "aaa authorization console" enabled; since you don't have TACACS to account for which user performed which commands, "aaa accounting command local" is a way to log these activities in the local buffer, visible via "show logging"; the previous mentioned option for command accounting can work in parallel or be replaced by the archive logging feature, in which case you can see which user performed which CLI commands via "show archive log config all"):
aaa group server radius aas-radius
ip radius source-interface Vlanx
!
no aaa authorization config-commands
aaa authorization console
aaa accounting commands local
!
archive
log config
logging enable
logging size 1000
Next, when RADIUS server is configured correctly, to assign privilege-level as well, you don't need the same username to also exist in the switch configuration, follow this guide to ensure you have NPS well configured:
https://www.mcgearytech.com/how-to-integrating-cisco-devices-cli-access-with-microsoft-npsradius/
Third, for your remote users getting privilege level 15, there's nothing else to be done, for users getting privilege level 7 with the rights you've mentioned, the following configuration is required (these users will be able to view complete running-configuration only by using command "show running-config view full":
privilege exec level 7 show running-config view full
file privilege 7
Thanks,
Cristian.
